Phishers are targeting Twitter users in a new attack involving direct messages sent to Twitter users containing a link to a site requesting user log-ins.

There are reports of a new phishing scam making the rounds on Twitter. The attack seeks to steal user credentials by sending tweets out with links to a phishing site. The attack site requests the user’s log-in information; once the attackers have that, they can take over the account of the victim and use it to send out more messages.

According to messages from Twitter users, the tweets with the link to the phishing site have to do with the sender supposedly making a certain amount of money. Such periodic phishing attacks on users of the popular microblogging service have become a fact of life.

I’m not exactly sure why anyone would want to steal a bunch of Twitter accounts? Perhaps to monetize them somehow with spam/affiliate schemes.

But the current threat on Twitter is a phishing scam executed via DM with a link to various things including ways to make money, a video of you or some other juicy gossip.

The cornerstones of social engineering in phishing attacks.

In May, researchers at Sophos reported that a number of Twitter users were lured to a phishing site via a tweet with the message: “check this guy out [tinyurl address leading to the attack site].” As was the case in that instance, URL shortening services are increasingly being abused by attackers to mask the Websites they are sending their victims to.

Besides drawing attackers as it has grown, Twitter has also gotten the interest of security researchers, as shown by the “Month of the Twitter Bugs.”

Twitter warned users about the attack, stating in a message: “A bit o’ phishing going on—if you get a weird direct message, don’t click on it and certainly don’t give your log-in creds!”

If you are using Twitter you should follow @spam and keep up to date with what is happening on the network.

Websecurify is a web and web2.0 security initiative specializing in researching security issues and building the next generation of tools to defeat and protect web technologies.

Key Features

JavaScript – Websecurify Security Testing Framework is the first tool of its kind to be written entirely in JavaScript using only standard technologies adopted by the leading browsers.

Multiple Environments – The core technology can run in normal browsers, xulrunner, xpcshell (command line), inside Java or as part of a custom V8 (Chrome’s JavaScript Engine) build. The core is written with extensibility in mind so that more environments can be supported without changing even a single line of code.

Multi-platform – The tool is available and successfully runs on Windows, Mac OS, Linux and other operating systems.

Automatic Updates – Every single piece of the tool is subjected to automatic updates. This means that newer and more advanced versions of the tool can be shipped to your front door without you lifting your finger. This however is completely optional. The automatic update can be turned off if needed.

Extensions – Because the tool comes wrapped in xulrunner by default (keep in mind that we can support any other JavaScript environment) we benefit from all cool features that Firefox has, such as extensions. Extensions are easy to write and maintain and can customize every single aspect of the tool and there are already tones of resources and documentation, including books and what not, out there to teach you exactly how to do that. We will be providing documentation as well.

This is one nasty piece of malware, seems like it’s working on a low level as per rootkits, there aren’t many technical details but it may well be operating on a Ring 0 level.

The level of detection by AV software is quite scary, especially since the malware is specifically targeting bank login details and it has the ability to intercept the browser process.

Definitely one to watch out for in your organization.

One of the world’s nastiest password-stealing trojans evades detection by the majority PCs running anti-virus programs, according to a study that examined 10,000 machines.

Zeus, a stealthy piece of malware that sits on a PC and waits for users to log in to bank websites, is detected just 23 per cent of time by AV programs, according to the study [PDF] released by security firm Trusteer. Even AV programs with up-to-date malware signatures were unable to identify the infection a majority of the time, the authors said.

Zeus, which also goes by the name Zbot and PRG, escapes detection using sophisticated techniques such as root-kit technology, the Trusteer report said. The company is able to detect it by examining the fingerprint Zeus leaves when it penetrates an infected PC’s browser process.

It seems to be operating on a level that the AV engines can’t even detect as when installed with the latest signatures they still can’t alert a user they are infected.

It’s time AV engines get a little more advanced and hook into important processes like the browser and ensure they aren’t being tampered with or monitored.

Some kind of active memory protection must be possible.

A recent report estimated that Zeus is the No. 1 trojan, with 3.6 million infections in the US alone, or about 1 per cent of the installed base of PCs. Trusteer’s study, which found Zeus accounted for 44 per cent of the banking malware infections, was consistent with that finding. After sneaking onto a PC, it sits quietly in the background until a user logs on to a financial website. It then sends the login credentials to a remote server in real time, sometimes by use of instant messaging programs.

Of Zeus-infected machines, about 31 per cent don’t run AV at all and 14 percent run AV that’s out of date. The remaining 55 per cent had AV programs that were up to date.

Sitting at number 1 trojan this is a serious issue, especially with the stealthy mode in which it operates it looks like it’s going to be hard to stop the infections.

I someone comes up with a tool or method to prevent and detect these infections.

Flawfinder is a program that examines source code and reports possible security weaknesses (flaws) sorted by risk level. It’s very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public. It’s a static analysis source code auditing tool.

Flawfinder is specifically designed to be easy to install and use. After installing it, at a command line just type:

1

flawfinder directory_with_source_code

Flawfinder works on Unix-like systems today (it’s been tested on GNU/Linux), and it should be easy to port to Windows systems. It requires Python 1.5 or greater to run (Python 1.3 or earlier won’t work).

Speed

Flawfinder is written in Python, to simplify the task of writing and extending it. Python code is not as fast as C code, but for the task I believe it’s just fine. Flawfinder version 0.12 on a 400Mhz Pentium II system analyzed 51055 lines in 39.7 seconds, resulting in an average of 1285 analyzed lines/second. Flawfinder 1.20 and later will report their speed (in analyzed lines/second) if you’re curious.

How it works

Flawfinder works by using a built-in database of C/C++ functions with well-known problems, such as buffer overflow risks (e.g., strcpy(), strcat(), gets(), sprintf(), and the scanf() family), format string problems ([v][f]printf(), [v]snprintf(), and syslog()), race conditions (such as access(), chown(), chgrp(), chmod(), tmpfile(), tmpnam(), tempnam(), and mktemp()), potential shell metacharacter dangers (most of the exec() family, system(), popen()), and poor random number acquisition (such as random()). The good thing is that you don’t have to create this database – it comes with the tool.

Flawfinder then takes the source code text, and matches the source code text against those names, while ignoring text inside comments and strings (except for flawfinder directives). Flawfinder also knows about gettext (a common library for internationalized programs), and will treat constant strings passed through gettext as though they were constant strings; this reduces the number of false hits in internationalized programs.

It’s been a long time since we’ve heard about a problem with FreeBSD, partially because the mass of people using it isn’t that large and secondly because BSD tends to be pretty secure as operating systems go.

It’s a pretty serious flaw this time with root escalation, thankfully it’s only a local exploit though and not remotely exploitable.

Although a user could get user access on the system through an exploit in a web facing application, and use some kind of PHP/Python web shell to exploit and get root.

A security researcher has uncovered a security bug in the FreeBSD operating system that allows users with limited privileges to take full control of underlying systems.

The bug in FreeBSD’s kqueue notification interface makes it trivial for those with local access to a vulnerable system to gain full root privileges, Przemyslaw Frasunek, an independent security consultant in Poland, told The Register. It affects versions 6.0 through 6.4 of the operating system, the last two versions of which enjoy wide use and continue to be supported by the FreeBSD Foundation.

Versions 7.1 and and beyond are not vulnerable.

With a lot of people still using FreeBSD 6.3 and 6.4, amongst the FreeBSD community I’d say this could be quite a widespread problem.

A lot of BSD boxes are used for web hosting too, so I’d imagine a lot have SSH access enabled giving people local access and the capability of executing this exploit.

Those exploiting the bug must first have local access to a vulnerable system, either as a legitimate user or by exploiting some other flaw (say, a vulnerable PHP script) that gives an attacker a toe-hold in to the targeted system. Frasunek said the vulnerability is trivial to exploit, as a video he posted here suggests.

The bug is the result of a race condition in the FreeBSD kqueue that leads to a NULL pointer dereference in kernel mode. Attackers can cause vulnerable systems to run malware by putting the code in a memory page mapped to address 0x0.

Frasunek said he notified FreeBSD officials on August 29 and has yet to get a response. Robert Watson, a FreeBSD Core Team member, told El Reg that it appeared the email had gotten “lost in the slew” and he expected an advisory to be issued soon.

If you’re using the latest production release (at this time 7.2) you aren’t vulnerable to this problem, I hope to see them backport the patch to the previous versions as they still have a sizable following.

You should see an advisory hitting the mailing lists soon, and I’d expect it to be fixed pretty quickly too.

Beware if you are using FreeBSD and have users with local access you don’t trust.

4f is a file format fuzzing framework. 4f uses modules which are specifications of the targeted binary or text file format that tell it how to fuzz the target application. If 4f detects a crash, it will log crucial information important for allowing the 4f user to reproduce the problem and also debugging information important to deciding the severity of the bug and its exploitability.

4f’s purpose is to find vulnerabilities in code that parses file formats including configuration files.

4f uses specialized modules for fuzzing code that interprets file formats. Several modules are included and more can be written to follow other file formats.

A module system is in place for fuzzing any file format you like as long as you know its specification

Seems like the Feds have been busy in recent year, all kinds of hackers, phishers an dnow pirates are getting arrested and imprisoned for some serious jailtime.

The latest in this strung of busts is the music piracy ground RNS or Rabid Neurosis, very eminent in the scene in the late 90s/early 2000s.

With P2P and people ripping stuff themselves, is ‘the scene’ dying or are most releases repackaged group releases? I’ve been out of the whole 0day warez/racing/fxp thing for a long time, so I honestly have no idea.

Six men have been accused of running the world’s most prolific music piracy ring, an online crew federal prosecutors allege delivered more than 25,000 copyrighted albums, often before they were officially released.

As members of Rabid Neurosis, or RNS as the group was called, they tapped insiders at music retailers, radio stations, and CD manufacturing plants, who were able to get their hands on music titles before their commercial release in the US. In other cases, they turned to affiliates elsewhere in the world, who were able to supply music that was not yet available in America.

“These reproductions were done for the benefit of the members of RNS and other affiliated piracy groups, in that, by getting a reputation for providing pirated materials that were previously unavailable on the piracy scene, RNS members were granted access to massive libraries of pirated music, video games, software and movies,” prosecutors alleged in court documents filed Wednesday.

They have an impressive record though often releasing full retail albums before they were for sale! They stopped around 2007 tho, I guess that’s when Bit Torrent and p2p was really taking off.

25,000 albums is a serious number though I’d guess their restitution is definitely going to be in the millions. But then historically the fines given out for piracy cases has just been completely ridiculous.

The most likely outcome, 6 more people filling for bankruptcy.

The claim of personal benefit is important, since sentencing guidelines frequently require a showing that copyright infringers financially gained from their activities.

Wednesday’s indictment, filed in US District Court in the Eastern District of Virginia, named Adil R. Cassim, 29, of Granada Hills, California, the alleged leader of the group, Matthew D. Chow, 28, of Missouri City, Texas, Bennie L. Glover, 35, of Shelby, North Carolina, an employee of a CD production plant, and Edward Mohan II, 46, of Baltimore.

Each was charged with a single count of conspiracy to commit copyright infringement. If convicted each faces a maximum sentence of five years in prison and a fine of $250,000, in addition to a possible order to pay restitution.

Patrick L. Saunders, 30, of Brooklyn, New York, was charged in August and pleaded guilty on Tuesday to one count of copyright infringement. James A. Dockery, 39, of Mooresboro, North Carolina was charged on Tuesday.

They had an impressive network of contacts with people from retail outlets, cd printing factories and radio stations. All the people who get tracks and whole albums before they hit the streets.

I’m sure there will be plenty more similar cases to follow in the near future.

I thought a while ago about posting some stuff on Bluetooth hacking, but never got round to it. Have posted a couple of new articles on Bluetooth but haven’t yet posted any tools. So let’s start with Haraldscan – a Bluetooth discovery scanner.

The scanner will be able to determine Major and Minor device class of device, as well as attempt to resolve the device’s MAC address to the largest known Bluetooth MAC address Vendor list.

The goal of this project is to obtain as many MAC addresses mapped to device vendors as possible.

A fairly serious flaw that was announced in October 2008 by Outpost24 (and apparently discovered way back in 2005), has finally been patched by the major players Cisco and Microsoft.

So far Redhat has offered a workaround for the flaw and Juniper has responded that their equipment is not vulnerable.

It could be that Juniper doesn’t really understand the attack yet, if so that’s bad news as most of the Internet backbone (ISP Level) runs on Juniper equipment.

Microsoft and Cisco have issued updates that protect against a new class of attack that requires very little bandwidth and can leave servers and routers paralyzed even after a flood of malicious data has stopped.

The bug in the TCP, or transmission control protocol, was disclosed in October by security researchers Jack Louis and Robert E. Lee of Sweden-based Outpost24. It gave many security watchers pause because it provided attackers with a new way to launch potentially crippling attacks on a wide array of equipment used to route traffic over the internet.

“This is definitely momentum and other vendors, once they fully understand what has been talked about here, will come up with mitigation strategies of their own,” Lee told The Register. “This really is good progress from both Microsoft and Cisco.”

Microsoft rolled it out in their normal “Patch Tuesday” fashion and Cisco issued a bulletin about especially disruptive DoS attacks.

Good to see it being addressed finally, I guess it took Microsoft some time and money in R&D to come up with a satisfactory solution.

I wonder if any other vendors will be following suite shortly.

On Tuesday, Microsoft responded with MS09-048, a security advisory that fixes a variety of networking vulnerabilities in Windows operating systems, including those discovered by Louis and Lee. The update implements a new feature called memory pressure protection, which automatically drops existing TCP connections and SYN requests when attacks are detected.

The update from Microsoft came during the company’s Patch Tuesday, in which it fixed a total of eight security vulnerabilities in various versions of its Windows operating system. In all, Microsoft issued five patches, which change the way Windows processes javascript, MP3 audio files and wireless signals. As always, the Sans Institute provides a helpful overview here.

Cisco issued it’s own bulletin warning that multiple products are vulnerable to DoS, or denial-of-service attacks that can be especially disruptive.

It’s often hard to fix problems like this in core components because a band-aid solution could end up breaking some of the functionality, especially with something like the TCP stack which is relied on so heavily.

Even then, a patch is released but how many people actually apply it? Cisco equipment is well known for being hard to manage/patch so I’d imagine many network devices will remain unpatched.